chore(ci): scope nix-check workflow permissions to contents:read (#1870)

The other workflows under .github/workflows declare explicit
`permissions:` blocks that scope their GITHUB_TOKEN to the minimum
required (contents: read for build-only flows). `nix-check.yml` was
the lone outlier and inherited the repository's default token
permissions instead.

Add `permissions: { contents: read }` to align with the rest of the
workflow suite and follow GitHub's least-privilege workflow guidance.
No behavior change: the job only reads the repo, runs `nix flake
check`, and uploads a logs artifact on failure (which uses an action
that already declares its own permissions internally).

Co-authored-by: nicejames <nicejames@gmail.com>

.github/workflows/nix-check.yml

@@ -46,6 +46,9 @@ on:
       - .github/PULL_REQUEST_TEMPLATE.md
       - .github/CODEOWNERS
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest